@opengeni/api-router 0.5.2 → 0.5.4

package/src/routes/documents.ts

@@ -8,12 +8,16 @@ import {
   KnowledgeMemory,
   KnowledgeMemorySearchRequest,
   UpdateKnowledgeMemoryRequest,
+  WorkspaceMemorySearchRequest,
+  WorkspaceMemorySearchResponse,
 } from "@opengeni/contracts";
 import {
   createKnowledgeMemory,
   getKnowledgeMemory,
   listKnowledgeMemories,
   updateKnowledgeMemory,
+  saveWorkspaceMemory,
+  searchWorkspaceMemories,
 } from "@opengeni/db";
 import {
   addDocumentToBase,
@@ -41,13 +45,20 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
     const payload = CreateDocumentBaseRequest.parse(await c.req.json());
-    return c.json(DocumentBase.parse(await createDocumentBase(db, { ...payload, accountId: grant.accountId, workspaceId })), 201);
+    return c.json(
+      DocumentBase.parse(
+        await createDocumentBase(db, { ...payload, accountId: grant.accountId, workspaceId }),
+      ),
+      201,
+    );
   });
 
   app.get("/v1/workspaces/:workspaceId/document-bases", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "documents:search");
-    return c.json((await listDocumentBases(db, workspaceId)).map((base) => DocumentBase.parse(base)));
+    return c.json(
+      (await listDocumentBases(db, workspaceId)).map((base) => DocumentBase.parse(base)),
+    );
   });
 
   app.get("/v1/workspaces/:workspaceId/document-bases/:baseId", async (c) => {
@@ -66,12 +77,30 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!objectStorage) {
       throw new HTTPException(503, { message: "object storage is not configured" });
     }
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "document:index",
+      quantity: 0,
+    });
     const payload = AddDocumentRequest.parse(await c.req.json());
     try {
-      const document = await addDocumentToBase(db, { ...payload, accountId: grant.accountId, workspaceId, baseId: c.req.param("baseId") });
-      const wasCreated = document.status === "queued" && document.chunkCount === 0 && document.error === null;
-      const indexed = document.status === "ready" ? document : (await documentIndexer.indexDocument({ accountId: grant.accountId, workspaceId, documentId: document.id }) ?? document);
+      const document = await addDocumentToBase(db, {
+        ...payload,
+        accountId: grant.accountId,
+        workspaceId,
+        baseId: c.req.param("baseId"),
+      });
+      const wasCreated =
+        document.status === "queued" && document.chunkCount === 0 && document.error === null;
+      const indexed =
+        document.status === "ready"
+          ? document
+          : ((await documentIndexer.indexDocument({
+              accountId: grant.accountId,
+              workspaceId,
+              documentId: document.id,
+            })) ?? document);
       if (indexed.status === "ready") {
         await recordWorkspaceUsage(deps, {
           accountId: grant.accountId,
@@ -94,66 +123,86 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "documents:search");
-    return c.json((await listDocuments(db, workspaceId, c.req.param("baseId"))).map((document) => Document.parse(document)));
-  });
-
-  app.delete("/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
-    try {
-      await deleteDocumentFromBase(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        baseId: c.req.param("baseId"),
-        documentId: c.req.param("documentId"),
-      });
-      return c.body(null, 204);
-    } catch (error) {
-      throw documentHttpException(error);
-    }
+    return c.json(
+      (await listDocuments(db, workspaceId, c.req.param("baseId"))).map((document) =>
+        Document.parse(document),
+      ),
+    );
   });
 
-  app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId/reindex", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
-    if (!objectStorage) {
-      throw new HTTPException(503, { message: "object storage is not configured" });
-    }
-    await requireLimit(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
-    try {
-      const document = await getDocument(db, workspaceId, c.req.param("documentId"));
-      if (!document) {
-        throw new HTTPException(404, { message: "document not found" });
-      }
-      if (document.status !== "failed") {
-        throw new HTTPException(422, { message: "only failed documents can be retried" });
-      }
-      if (document.baseId !== c.req.param("baseId")) {
-        throw new HTTPException(404, { message: "document not found" });
-      }
-      const queued = await queueDocumentForReindex(db, workspaceId, document.id);
-      const indexed = await documentIndexer.indexDocument({ accountId: grant.accountId, workspaceId, documentId: document.id }) ?? queued;
-      if (indexed.status === "ready") {
-        await recordWorkspaceUsage(deps, {
+  app.delete(
+    "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
+      try {
+        await deleteDocumentFromBase(db, {
           accountId: grant.accountId,
           workspaceId,
-          subjectId: grant.subjectId,
-          eventType: "document.indexed",
-          quantity: indexed.chunkCount,
-          unit: "chunk",
-          sourceResourceType: "document",
-          sourceResourceId: indexed.id,
-          idempotencyKey: `document.indexed:${workspaceId}:${indexed.id}:${indexed.updatedAt}`,
+          baseId: c.req.param("baseId"),
+          documentId: c.req.param("documentId"),
         });
+        return c.body(null, 204);
+      } catch (error) {
+        throw documentHttpException(error);
       }
-      return c.json(Document.parse(indexed));
-    } catch (error) {
-      if (error instanceof HTTPException) {
-        throw error;
+    },
+  );
+
+  app.post(
+    "/v1/workspaces/:workspaceId/document-bases/:baseId/documents/:documentId/reindex",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
+      if (!objectStorage) {
+        throw new HTTPException(503, { message: "object storage is not configured" });
       }
-      throw documentHttpException(error);
-    }
-  });
+      await requireLimit(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        action: "document:index",
+        quantity: 0,
+      });
+      try {
+        const document = await getDocument(db, workspaceId, c.req.param("documentId"));
+        if (!document) {
+          throw new HTTPException(404, { message: "document not found" });
+        }
+        if (document.status !== "failed") {
+          throw new HTTPException(422, { message: "only failed documents can be retried" });
+        }
+        if (document.baseId !== c.req.param("baseId")) {
+          throw new HTTPException(404, { message: "document not found" });
+        }
+        const queued = await queueDocumentForReindex(db, workspaceId, document.id);
+        const indexed =
+          (await documentIndexer.indexDocument({
+            accountId: grant.accountId,
+            workspaceId,
+            documentId: document.id,
+          })) ?? queued;
+        if (indexed.status === "ready") {
+          await recordWorkspaceUsage(deps, {
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: grant.subjectId,
+            eventType: "document.indexed",
+            quantity: indexed.chunkCount,
+            unit: "chunk",
+            sourceResourceType: "document",
+            sourceResourceId: indexed.id,
+            idempotencyKey: `document.indexed:${workspaceId}:${indexed.id}:${indexed.updatedAt}`,
+          });
+        }
+        return c.json(Document.parse(indexed));
+      } catch (error) {
+        if (error instanceof HTTPException) {
+          throw error;
+        }
+        throw documentHttpException(error);
+      }
+    },
+  );
 
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/search", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -164,15 +213,19 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(404, { message: "document base not found" });
     }
     return c.json({
-      results: await searchDocuments(db, {
-        workspaceId,
-        baseIds: [base.id],
-        query: payload.query,
-        limit: payload.limit,
-        mode: payload.mode,
-        sourceKinds: payload.sourceKinds,
-        aclTags: payload.aclTags,
-      }, getDocumentServices()),
+      results: await searchDocuments(
+        db,
+        {
+          workspaceId,
+          baseIds: [base.id],
+          query: payload.query,
+          limit: payload.limit,
+          mode: payload.mode,
+          sourceKinds: payload.sourceKinds,
+          aclTags: payload.aclTags,
+        },
+        getDocumentServices(),
+      ),
     });
   });
 
@@ -181,15 +234,19 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     await requireAccessGrant(c, deps, workspaceId, "documents:search");
     const payload = DocumentSearchRequest.parse(await c.req.json());
     return c.json({
-      results: await searchDocuments(db, {
-        workspaceId,
-        query: payload.query,
-        baseIds: payload.baseIds,
-        limit: payload.limit,
-        mode: payload.mode,
-        sourceKinds: payload.sourceKinds,
-        aclTags: payload.aclTags,
-      }, getDocumentServices()),
+      results: await searchDocuments(
+        db,
+        {
+          workspaceId,
+          query: payload.query,
+          baseIds: payload.baseIds,
+          limit: payload.limit,
+          mode: payload.mode,
+          sourceKinds: payload.sourceKinds,
+          aclTags: payload.aclTags,
+        },
+        getDocumentServices(),
+      ),
     });
   });
 
@@ -206,7 +263,11 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid knowledge memory query parameters" });
     }
-    return c.json((await listKnowledgeMemories(db, workspaceId, parsed.data)).map((memory) => KnowledgeMemory.parse(memory)));
+    return c.json(
+      (await listKnowledgeMemories(db, workspaceId, parsed.data)).map((memory) =>
+        KnowledgeMemory.parse(memory),
+      ),
+    );
   });
 
   app.get("/v1/workspaces/:workspaceId/knowledge/memories/:memoryId", async (c) => {
@@ -219,28 +280,100 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(KnowledgeMemory.parse(memory));
   });
 
+  // Hybrid search over the workspace's agent-visible memory (active ∪ approved).
+  // Available regardless of the workspace memory setting (human/audit lane).
+  app.post("/v1/workspaces/:workspaceId/knowledge/memories/search", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    await requireAccessGrant(c, deps, workspaceId, "documents:search");
+    const parsed = WorkspaceMemorySearchRequest.safeParse(await c.req.json());
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid workspace memory search request" });
+    }
+    const results = await searchWorkspaceMemories(
+      db,
+      workspaceId,
+      parsed.data,
+      getDocumentServices().embedder,
+    );
+    return c.json(
+      WorkspaceMemorySearchResponse.parse({
+        results: results.map((result) => ({
+          ...result,
+          memory: KnowledgeMemory.parse(result.memory),
+        })),
+      }),
+    );
+  });
+
   app.post("/v1/workspaces/:workspaceId/knowledge/memories", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
-    const payload = CreateKnowledgeMemoryRequest.parse(await c.req.json());
-    return c.json(KnowledgeMemory.parse(await createKnowledgeMemory(db, {
-      ...payload,
-      accountId: grant.accountId,
-      workspaceId,
-    })), 201);
+    const parsedBody = CreateKnowledgeMemoryRequest.safeParse(await c.req.json());
+    if (!parsedBody.success) {
+      throw new HTTPException(400, { message: "invalid knowledge memory request" });
+    }
+    const payload = parsedBody.data;
+    // status `active` (the default) is a memory write → route through the single
+    // gate (sanitize + embed + dedup). Explicit proposed/approved/rejected keeps
+    // the legacy curated create.
+    if (payload.status === "active") {
+      try {
+        const result = await saveWorkspaceMemory(
+          db,
+          {
+            accountId: grant.accountId,
+            workspaceId,
+            text: payload.text,
+            kind: payload.kind,
+            confidence: payload.confidence,
+            pinned: payload.pinned,
+            replacesId: payload.replacesId ?? null,
+            metadata: payload.metadata,
+            origin: "human",
+          },
+          getDocumentServices().embedder,
+        );
+        return c.json(KnowledgeMemory.parse(result.memory), 201);
+      } catch (error) {
+        throw documentHttpException(error);
+      }
+    }
+    return c.json(
+      KnowledgeMemory.parse(
+        await createKnowledgeMemory(db, {
+          ...payload,
+          accountId: grant.accountId,
+          workspaceId,
+        }),
+      ),
+      201,
+    );
   });
 
   app.patch("/v1/workspaces/:workspaceId/knowledge/memories/:memoryId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:manage");
     const payload = UpdateKnowledgeMemoryRequest.parse(await c.req.json());
-    const reviewedBy = payload.reviewedBy
-      ?? (payload.status === "approved" || payload.status === "rejected" ? grant.subjectLabel ?? grant.subjectId : undefined);
+    const reviewedBy =
+      payload.reviewedBy ??
+      (payload.status === "approved" || payload.status === "rejected"
+        ? (grant.subjectLabel ?? grant.subjectId)
+        : undefined);
     try {
-      return c.json(KnowledgeMemory.parse(await updateKnowledgeMemory(db, workspaceId, c.req.param("memoryId"), {
-        ...payload,
-        ...(reviewedBy ? { reviewedBy } : {}),
-      })));
+      return c.json(
+        KnowledgeMemory.parse(
+          await updateKnowledgeMemory(
+            db,
+            workspaceId,
+            c.req.param("memoryId"),
+            {
+              ...payload,
+              ...(reviewedBy ? { reviewedBy } : {}),
+            },
+            getDocumentServices().embedder,
+          ),
+        ),
+      );
     } catch (error) {
       throw documentHttpException(error);
     }
@@ -249,9 +382,16 @@ export function registerDocumentRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.all("/v1/workspaces/:workspaceId/mcp/docs", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "documents:search");
-    const sessionId = typeof grant.metadata?.sessionId === "string" ? grant.metadata.sessionId : undefined;
+    const sessionId =
+      typeof grant.metadata?.sessionId === "string" ? grant.metadata.sessionId : undefined;
     const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
-    const server = buildDocumentsMcpServer(db, grant.accountId, workspaceId, getDocumentServices(), { createdBySessionId: sessionId });
+    const server = buildDocumentsMcpServer(
+      db,
+      grant.accountId,
+      workspaceId,
+      getDocumentServices(),
+      { createdBySessionId: sessionId },
+    );
     await server.connect(transport);
     return await transport.handleRequest(c.req.raw);
   });
@@ -265,5 +405,15 @@ function documentHttpException(error: unknown): HTTPException {
   if (message.includes("pending") || message.includes("failed") || message.includes("deleted")) {
     return new HTTPException(422, { message });
   }
+  // Workspace-memory write-gate rejections are client errors, not server faults.
+  if (
+    message.includes("too long") ||
+    message.includes("visible memory is full") ||
+    message.includes("empty after sanitization") ||
+    message.includes("does not match") ||
+    message.includes("Ambiguous memory id")
+  ) {
+    return new HTTPException(400, { message });
+  }
   return new HTTPException(500, { message });
 }

package/src/routes/enrollments.ts

@@ -39,11 +39,7 @@ import {
   type EnrollmentArch,
   type EnrollmentOs,
 } from "@opengeni/contracts";
-import {
-  getWorkspace,
-  listEnrollments,
-  revokeEnrollment,
-} from "@opengeni/db";
+import { getWorkspace, listEnrollments, revokeEnrollment } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
@@ -66,7 +62,9 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
   // surface invisible while disabled — it does not exist for this deployment yet.
   function assertSelfhostedEnabled(): void {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException(404, { message: "selfhosted enrollment is not enabled for this deployment" });
+      throw new HTTPException(404, {
+        message: "selfhosted enrollment is not enabled for this deployment",
+      });
     }
   }
 
@@ -106,18 +104,21 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!workspace) {
       throw new HTTPException(404, { message: "workspace not found" });
     }
-    const result = await startDeviceEnrollment({ db, settings }, {
-      accountId: workspace.accountId,
-      workspaceId: workspace.id,
-      publicKey: body.publicKey,
-      os: body.os as EnrollmentOs,
-      arch: body.arch as EnrollmentArch,
-      machineName: body.machineName ?? null,
-      canOfferDisplay: body.canOfferDisplay,
-      requestsScreenControl: body.requestsScreenControl,
-      // The approve page is served at the SAME origin as this request.
-      verificationOrigin: new URL(c.req.url).origin,
-    });
+    const result = await startDeviceEnrollment(
+      { db, settings },
+      {
+        accountId: workspace.accountId,
+        workspaceId: workspace.id,
+        publicKey: body.publicKey,
+        os: body.os as EnrollmentOs,
+        arch: body.arch as EnrollmentArch,
+        machineName: body.machineName ?? null,
+        canOfferDisplay: body.canOfferDisplay,
+        requestsScreenControl: body.requestsScreenControl,
+        // The approve page is served at the SAME origin as this request.
+        verificationOrigin: new URL(c.req.url).origin,
+      },
+    );
     return c.json(result, 201);
   });
 
@@ -129,7 +130,10 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid device-poll request" });
     }
-    const result = await pollDeviceEnrollment({ db, settings }, { deviceCode: parsed.data.deviceCode });
+    const result = await pollDeviceEnrollment(
+      { db, settings },
+      { deviceCode: parsed.data.deviceCode },
+    );
     return c.json(result, 200);
   });
 
@@ -146,7 +150,10 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid device-lookup request" });
     }
-    const record = await lookupDeviceEnrollment({ db, settings }, { userCode: parsed.data.userCode });
+    const record = await lookupDeviceEnrollment(
+      { db, settings },
+      { userCode: parsed.data.userCode },
+    );
     if (!record) {
       // Unknown / terminal / expired code → 404 (indistinguishable from an
       // unauthorized one below, by design).
@@ -177,14 +184,17 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(400, { message: "invalid enroll-token-exchange request" });
     }
     const body = parsed.data;
-    const result = await exchangeEnrollToken({ db, settings }, {
-      token: body.token,
-      publicKey: body.publicKey,
-      os: body.os as EnrollmentOs,
-      arch: body.arch as EnrollmentArch,
-      machineName: body.machineName ?? null,
-      canOfferDisplay: body.canOfferDisplay,
-    });
+    const result = await exchangeEnrollToken(
+      { db, settings },
+      {
+        token: body.token,
+        publicKey: body.publicKey,
+        os: body.os as EnrollmentOs,
+        arch: body.arch as EnrollmentArch,
+        machineName: body.machineName ?? null,
+        canOfferDisplay: body.canOfferDisplay,
+      },
+    );
     if (!result.ok) {
       if (result.reason === "disabled") {
         // The credential plane is off for this deployment (no signing secret).
@@ -207,25 +217,31 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(400, { message: "invalid device-approve request" });
     }
     const body = parsed.data;
-    const approved = await approveDeviceEnrollment({ db, settings }, {
-      accountId: grant.accountId,
-      workspaceId,
-      userCode: body.userCode,
-      allowScreenControl: body.allowScreenControl,
-      // The LOUD consent record: WHO consented (the authenticated subject + label).
-      approvedBySubjectId: grant.subjectId,
-      approvedBySubjectLabel: grant.subjectLabel ?? null,
-    });
+    const approved = await approveDeviceEnrollment(
+      { db, settings },
+      {
+        accountId: grant.accountId,
+        workspaceId,
+        userCode: body.userCode,
+        allowScreenControl: body.allowScreenControl,
+        // The LOUD consent record: WHO consented (the authenticated subject + label).
+        approvedBySubjectId: grant.subjectId,
+        approvedBySubjectLabel: grant.subjectLabel ?? null,
+      },
+    );
     if (!approved) {
       // An unknown / expired / already-terminal user_code in this workspace.
       throw new HTTPException(404, { message: "no pending enrollment for that code" });
     }
-    return c.json(DeviceEnrollmentApproveResponse.parse({
-      approved: true,
-      enrollmentId: approved.enrollmentId,
-      sandboxId: approved.sandboxId,
-      allowScreenControl: approved.allowScreenControl,
-    }), 201);
+    return c.json(
+      DeviceEnrollmentApproveResponse.parse({
+        approved: true,
+        enrollmentId: approved.enrollmentId,
+        sandboxId: approved.sandboxId,
+        allowScreenControl: approved.allowScreenControl,
+      }),
+      201,
+    );
   });
 
   // ── POST /workspaces/:workspaceId/enrollments/device/deny (user-authed) ─────
@@ -239,11 +255,14 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid device-deny request" });
     }
-    const result = await denyDeviceEnrollment({ db, settings }, {
-      accountId: grant.accountId,
-      workspaceId,
-      userCode: parsed.data.userCode,
-    });
+    const result = await denyDeviceEnrollment(
+      { db, settings },
+      {
+        accountId: grant.accountId,
+        workspaceId,
+        userCode: parsed.data.userCode,
+      },
+    );
     return c.json(DeviceEnrollmentDenyResponse.parse({ denied: result.denied }), 200);
   });
 
@@ -261,11 +280,14 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!parsed.success) {
       throw new HTTPException(400, { message: "invalid mint-enroll-token request" });
     }
-    const minted = await mintEnrollToken({ db, settings }, {
-      accountId: grant.accountId,
-      workspaceId,
-      allowScreenControl: parsed.data.allowScreenControl,
-    });
+    const minted = await mintEnrollToken(
+      { db, settings },
+      {
+        accountId: grant.accountId,
+        workspaceId,
+        allowScreenControl: parsed.data.allowScreenControl,
+      },
+    );
     if (!minted) {
       // The credential plane is off (no signing secret) — mirror poll's disabled path.
       throw new HTTPException(503, { message: "enrollment credential plane is not configured" });
@@ -279,23 +301,31 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     await requireAccessGrant(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const statusFilter = c.req.query("status");
-    const rows = await listEnrollments(db, workspaceId, statusFilter === "active" ? { status: "active" } : {});
-    return c.json(ListEnrollmentsResponse.parse({
-      enrollments: rows.map((row) => EnrollmentSummary.parse({
-        id: row.id,
-        pubkey: row.pubkey,
-        exposure: row.exposure,
-        hasDisplay: row.hasDisplay,
-        desktopUnavailableReason: row.desktopUnavailableReason,
-        allowScreenControl: row.allowScreenControl,
-        status: row.status,
-        os: row.os,
-        arch: row.arch,
-        lastSeenAt: row.lastSeenAt,
-        createdAt: row.createdAt,
-        revokedAt: row.revokedAt,
-      })),
-    }));
+    const rows = await listEnrollments(
+      db,
+      workspaceId,
+      statusFilter === "active" ? { status: "active" } : {},
+    );
+    return c.json(
+      ListEnrollmentsResponse.parse({
+        enrollments: rows.map((row) =>
+          EnrollmentSummary.parse({
+            id: row.id,
+            pubkey: row.pubkey,
+            exposure: row.exposure,
+            hasDisplay: row.hasDisplay,
+            desktopUnavailableReason: row.desktopUnavailableReason,
+            allowScreenControl: row.allowScreenControl,
+            status: row.status,
+            os: row.os,
+            arch: row.arch,
+            lastSeenAt: row.lastSeenAt,
+            createdAt: row.createdAt,
+            revokedAt: row.revokedAt,
+          }),
+        ),
+      }),
+    );
   });
 
   // ── POST /workspaces/:workspaceId/enrollments/:id/revoke (user-authed) ──────